You are building a timeline from iOS logs. You have entries from the unified log and crash reports. You notice that the crash report timestamps are in Unix epoch format, while the unified log uses ISO 8601. What is the best approach?

Convert the ISO 8601 timestamps to Unix epoch

Keep the timestamps in their original formats and sort alphabetically

Convert the Unix epoch timestamps to ISO 8601 and then merge

Use the crash report timestamps as they are because they are more precise

An examiner is investigating an iOS device for potential unauthorized access. The examiner has access to the device's unified log, a plist file from a third-party app, and a SQLite database from the same app. The unified log shows an app launching at 10:15:00, the plist shows a configuration change at 10:15:30, and the SQLite database shows a data export at 10:16:00. The examiner needs to determine if the configuration change triggered the data export. Which log source would be most relevant to establish causation?

All three sources equally, because each provides a piece of the puzzle.

The SQLite database, because it contains the exported data and can show when it was written.

The unified log, because it captures system-level process activity and can show the sequence of events.

The plist file, because it shows the configuration change that may have caused the export.

An examiner has built a timeline from macOS logs and a third-party application's SQLite database. The timeline shows a user logged in at 09:00, opened a document at 09:05, and sent an email at 09:10. However, the examiner finds a unified log entry showing a process crash at 09:03 that is not in the timeline. What should the examiner do to validate the timeline?

Remove the document open event because it may have been affected by the crash.

Assume the crash is a false positive and continue without changes.

Ignore the crash because it is a system-level event unrelated to user activity.

Add the crash event to the timeline and assess whether it affects the interpretation of subsequent events.

An examiner is analyzing a macOS system and needs to locate logs related to a specific application's network activity. The examiner knows the application stores data in a SQLite database and uses a plist for configuration. Which log source would provide the most direct evidence of network connections made by the application?

The application's SQLite database, because it may store network request logs.

The application's plist configuration file, because it may contain network settings.

The unified log, because it captures network-related events at the system level.

The system's security log, because it records all network connections.

An examiner is validating a timeline built from macOS unified logs and a third-party application's SQLite database. The timeline shows a user logged in at 09:00, opened a file at 09:05, and sent an email at 09:10. However, the examiner finds a unified log entry showing a process crash at 09:03 and a database record showing a file modification at 09:04. The crash is not in the timeline, and the file modification is not in the timeline. What is the most appropriate action to validate the timeline?

Add both the crash and the file modification to the timeline, then reassess the sequence and any potential impact.

Ignore both events because they are not directly related to the user's login, file open, or email activities.

Add only the crash to the timeline because it is a system-level event, and ignore the file modification.

Add only the file modification to the timeline because it is directly related to user activity.

GIAC iOS and macOS Examiner

Domain 2Objective 2

Log Analysis and Timeline Creation GIME Practice Questions (Page 3)

Part of the Forensic Analysis and Artifacts domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

5concepts

Questions 11–15

11application · medium
You are building a timeline from iOS logs. You have entries from the unified log and crash reports. You notice that the crash report timestamps are in Unix epoch format, while the unified log uses ISO 8601. What is the best approach?
Select an answer first
12application · medium
An examiner is investigating an iOS device for potential unauthorized access. The examiner has access to the device's unified log, a plist file from a third-party app, and a SQLite database from the same app. The unified log shows an app launching at 10:15:00, the plist shows a configuration change at 10:15:30, and the SQLite database shows a data export at 10:16:00. The examiner needs to determine if the configuration change triggered the data export. Which log source would be most relevant to establish causation?
Select an answer first
13application · medium
An examiner has built a timeline from macOS logs and a third-party application's SQLite database. The timeline shows a user logged in at 09:00, opened a document at 09:05, and sent an email at 09:10. However, the examiner finds a unified log entry showing a process crash at 09:03 that is not in the timeline. What should the examiner do to validate the timeline?
Select an answer first
14application · medium
An examiner is analyzing a macOS system and needs to locate logs related to a specific application's network activity. The examiner knows the application stores data in a SQLite database and uses a plist for configuration. Which log source would provide the most direct evidence of network connections made by the application?
Select an answer first
15expert · hard
An examiner is validating a timeline built from macOS unified logs and a third-party application's SQLite database. The timeline shows a user logged in at 09:00, opened a file at 09:05, and sent an email at 09:10. However, the examiner finds a unified log entry showing a process crash at 09:03 and a database record showing a file modification at 09:04. The crash is not in the timeline, and the file modification is not in the timeline. What is the most appropriate action to validate the timeline?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Log Analysis and Timeline Creation GIME Practice Questions (Page 3)

Questions 11–15

You are building a timeline from iOS logs. You have entries from the unified log and crash reports. You notice that the crash report timestamps are in Unix epoch format, while the unified log uses ISO 8601. What is the best approach?

Keep studying — Forensic Analysis and Artifacts